Extracted

• • Target

    JaffaCakes118_ccb20ed4f2e000c0dfea6ffa34bda6b4

  • Size

    782KB

  • MD5

    ccb20ed4f2e000c0dfea6ffa34bda6b4

  • SHA1

    80f1c218c9a4f006ac26d03d834eaa90ebcf4a5d

  • SHA256

    9cf41a9b8963753aa8d20e7f1f3ecea05f5ff876b15487682663d115a676117f

  • SHA512

    188481f6ae3b706d0c73bb137f9d86af7b2a43d43bc55280d06a5caaaa360f1dcbd240da8bcd18f9b2738a26910e2ff559db3fdfcaed13cca947200196bfc10e

  • SSDEEP

    24576:ZBoxwIfsRB0bv1ZdlfD95HkZzQkwG5+Lc:TUwCgB0bdZ3MJQkb5Oc

  Score

  10^/10

  remcoswechatxdiscoveryevasionexecutionpersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2